Electronic control system and method having monitor program monitoring function

ABSTRACT

An ECU is equipped with an engine control microcomputer for executing engine control and a throttle control microcomputer for executing throttle control. The engine control microcomputer is programmed to execute a monitor program. A time in the engine control microcomputer is set with a predetermined time each time the monitor program is executed normally. The timer switches automatically its output logic level at a port from high to low, when the time count reaches zero. When the output logic level is switched to low, a throttle motor is disabled.

CROSS REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of Japanese PatentApplication No. 2001-28459 filed on Feb. 5, 2001, the contents of whichare incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to an electronic control system and methodthat are capable of detecting microcomputer malfunction by monitoringoperations of one microcomputer by another one. Especially, the presentinvention relates to a throttle control microcomputer and method thatconduct electronic throttle control of an engine of a vehicle.

2. Related Art

Electronic control systems have the monitoring function to detect amicrocomputer malfunction by monitoring operations of a plurality ofmicrocomputers against one another. For example, an electronic controlsystem of a vehicle has an engine control microcomputer for executingengine control (spark ignition, fuel injection or the like) and athrottle control microcomputer for executing electronic throttlecontrol. A monitoring program is provided in the engine controlmicrocomputer, thereby to monitor the throttle control microcomputer inthe engine control microcomputer. For instance, in U.S. Pat. No.6,230,094 (JP-A-11-294252), an engine control microcomputer monitors athrottle control microcomputer. When the engine control microcomputerdetects malfunction of the throttle control microcomputer, the enginemicrocomputer resets the throttle control microcomputer and executes thethrottle control in place of the throttle control microcomputer.

In order to increase reliability and safety of the throttle controlmicrocomputer, it is desired to monitor operations of the monitoringprogram itself. Therefore, in JP-A-11-294252, a watch-dog pulse isoutputted periodically, and the watch-dog pulse is inputted to awatch-dog timer. Thus, the monitoring program is watched. It is,however, required to provide a hardware IC to watch the monitoringprogram.

SUMMARY OF THE INVENTION

It is therefore an object of the present invention to provide anelectronic control system, which is capable of obviating the aboveproblem.

It is another object of the present invention to provide an electroniccontrol system, which is capable of attaining a monitoring function of amicrocomputer.

According to the present invention, a first microcomputer is programmedto control a first object such as a fuel injection or ignition timing ofan engine. The first microcomputer has a monitor program for checkingmalfunction of a second microcomputer periodically. The secondmicrocomputer is programmed to control a second object such as athrottle driving motor. The first microcomputer comprises a timer and atimer setting unit. The timer increases or decreases time count inproportion to time, and switches the output logic level of its port whenthe time count reaches a predetermined time. The timer setting unit setsa new time count in place of the time counted by the timer when anoperation of the second microcomputer is normal and the monitor programis normal.

BRIEF DESCRIPTION OF THE DRAWINGS

Other objects, features and advantages of the present invention will beunderstood more fully from the following detailed description made withreference to the accompanying drawings. In the drawings:

FIG. 1 is a block diagram showing an electronic control system forengines according to a first embodiment of the present invention;

FIG. 2 is a flow diagram showing a base routine executed by an enginecontrol microcomputer in the first embodiment;

FIG. 3 is a flow diagram showing an interrupt routine executed by theengine control microcomputer in the first embodiment;

FIG. 4 is a timing diagram showing a check processing of the monitorprogram in the first embodiment;

FIG. 5 is a block diagram showing an electronic control system forengines according to a second embodiment of the present invention; and

FIG. 6 is a flow diagram showing an interrupt routine executed by theengine control microcomputer according to a third embodiment of thepresent invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

First Embodiment

An electronic control system has an electronic control unit (ECU), whichhas a plurality of microcomputers. The microcomputers execute enginecontrol such as fuel injection control, fuel ignition control,electronic throttle control or the like, respectively.

As shown in FIG. 1, the ECU 10 is equipped with an engine controlmicrocomputer 11 for executing engine control, and an electronicthrottle control microcomputer 12 for executing electronic throttlecontrol. These microcomputers 11, 12 are connected with each other, andare capable of serial communication therebetween.

The engine control microcomputer 11 receives an accelerator positionsignal, throttle position signal and other engine condition signals suchas a rotation speed signal. It calculates required ignition timing andfuel injection amount based on the received signals, and producescontrol signals to an igniter and an injector.

The throttle microcomputer 12 receives the accelerator position signaland the throttle position signal. It calculates required throttleposition for throttle control based on the received signals, andproduces a control signal to a motor drive circuit 13, which comprisesH-bridge circuit. The motor drive circuit 13 is connected to a throttlemotor 22 of a throttle actuator 21. The throttle motor 22 drives athrottle valve (not shown) and adjusts an amount of intake air suppliedto the engine.

The engine control microcomputer 11 is programmed to produce a WDC pulseto a WDT (watch-dog timer) 14, so that the WDT 14 may monitor theoperation of the engine control microcomputer 11 based on the receivedwatch-dog pulse. In this case, when the WDT 14 detects malfunction ofthe engine control microcomputer 11, for example a periodicity of theWDC pulse is out of order, the WDT 14 products a reset signal to theengine control microcomputer 11. Therefore, the engine controlmicrocomputer 11 is reset.

The engine control microcomputer 11 has a monitor program to be executedfor monitoring operations of the throttle control microcomputer 12. Theengine control microcomputer 11 is programmed to execute the monitorprogram as a periodic interrupt routine, so that the monitor program isexecuted in a predetermined frequency. The engine control microcomputer11, in executing the monitor program, for example, compares results ofcalculation made on the same data by the engine control microcomputer 11and the throttle control microcomputer 12, and detects malfunction ofthe throttle control microcomputer 12 when the compared calculationresults differ from each other.

The engine control microcomputer 11 has a timer 15. The timer 15 is seta predetermined time each time when the monitor program is accomplishednormally. The timer 15 has output compare function. The timer 15switches automatically its output logic level from high to low of itsport (throttle relay port A), when the time count is decreased to zero.

The timer 15 controls a transistor 16 based on the output logic level ofthe throttle relay port A. Namely, when the output logic level of thethrottle relay port A is high, the transistor 16 is turned on to close amotor relay 23. Therefore, the motor drive circuit 13 is supplied withelectric power from a battery to drive the throttle motor 22. On theother hand, when the output logic level of the throttle relay port A islow, the transistor 16 is turned off to open the motor relay 23.Therefore, motor drive circuit 13 is not supplied with electric powerfrom the battery to stop the throttle motor 22.

The engine control microcomputer 11 is programmed to execute a baseroutine shown in FIG. 2 and an interrupt routine shown in FIG. 3.

As shown in FIG. 2, after power-on of the ECU 10, the engine controlmicrocomputer 11 executes an initialization processing at step 101. Inthis initialization processing, the output logic level of the throttlerelay port A is initialized. Namely, when the time count of the timer 15is not zero, the output logic level of the throttle relay port A is sethigh. When the time count of the timer 15 is zero, the output logiclevel of the throttle relay port A is set low. Next, the engine controlmicrocomputer 11 executes an engine control processing at step 102 tocalculate the required ignition timing and fuel injection amount in theknown manner.

The interrupt routine, shown in FIG. 3, is executed every 16 ms. Asshown in FIG. 3, the engine control microcomputer 11 executes monitorprocessing at step 201 in the known manner. For instance, the enginecontrol microcomputer 11 checks (1) whether the monitor program isstarted and ended accurately (entry/end check), (2) whether the monitorprogram is executed in the predetermined order, (3) whether the throttleposition signal calculated by the throttle control microcomputer 12 isequal to the throttle position signal calculated by the engine controlmicrocomputer 11 or the like, as the monitor processing. Thus, if one ofthe monitor processing is detected as abnormal (malfunction), the enginecontrol microcomputer 11 sets an error flag indicative of themalfunction. Here, it is possible to dispense with above mentioned (1)or (2).

Next, at step 202, the engine control microcomputer 11 checks whetherthe monitor processing at step 201 is normal. The processing advances tostep 203 in response to an affirmative determination (YES). Then, theengine control microcomputer 11 checks whether the time count of thetimer 15 is in a predetermined acceptable region (e.g., 60 to 68 ms).Thus, the processing advances to step 204 in response to an affirmativedetermination (YES), and the engine control microcomputer 11 sets apredetermined time (e.g., 80 ms) as the initial time count of the timer15.

The processing advances to end this routine in response to a negativedetermination (NO) at step 202 or 203. Namely, when the monitorprocessing detects the malfunction at step 201, or when the executingtiming of the monitor program is not equal to predetermined timing(e.g., 16 ms), timer 15 is not set with the predetermined time (e.g., 80ms).

As shown in FIG. 4, before timing t1, the throttle control microcomputer12 is not detected as malfunctioning and the monitor program is executednormally. Therefore, the timer 15 is set with the predetermined time (80ms) at every 16 ms indicative of the executing interval of the monitorprogram. Namely, before 16 ms passes, the timer 15 is set with thepredetermined time over and over again. In this case, the output logiclevel of the throttle relay port A is maintained high. Thus, the motorrelay 23 is closed, and the electric power supplied to the throttlemotor 22 is maintained.

On the other hand, for example, when the malfunction of the throttlecontrol microcomputer 12 is detected or the monitor program is notexecuted normally at timing t1, the timer 15 will never be set with thepredetermined time (80 ms). Then, at timing t2, when the time count ofthe timer 15 is zero, the output logic level of the throttle relay portA is switched low. Thus, the motor relay 23 is opened, and the electricpower supplied to the throttle motor 22 is stopped. As a result,controlling the amount of intake air supplied to the engine by thethrottle actuator 21 is stopped.

According to this embodiment, the timer function that is equipped innormal microcomputer is used for monitoring operation. Therefore, ahardware IC for the monitoring operation is not required. Therefore, ECU10 can be simplified.

Furthermore, when the malfunction of the throttle control microcomputer12 is detected or the malfunction of the monitor program is not executedas designed, the output logic level of the throttle relay port A isswitched from high to low, and electronic throttle control is stopped.Thus, the ECU 10 monitors properly whether electronic throttle controlis executed normally.

Moreover, the ECU 10 monitors the interval of executing time of themonitor program based on the time count of the timer 15. When theinterval is within the acceptable region, the timer 15 is set with thepredetermined time (80 ms). Therefore, when the monitor program isexecuted in too short time or too long time, the ECU 10 detects themalfunction of the throttle control microcomputer 12 or the monitorprogram.

In this embodiment, it is possible to set the predetermined time formonitoring the WDC pulse equal to the predetermined time for monitoringthe monitor program. The predetermined time to set in the timer 15 maybe suitably changed.

Second Embodiment

In the second embodiment, shown in FIG. 5 one microcomputer (mainmicrocomputer) 31 of an ECU 30 has both engine control function andthrottle control function, and another microcomputer (auxiliarymicrocomputer) 32 has only monitoring function. For instance, a 32-bitmicrocomputer is used as the main microcomputer, and a 16- or 8-bitmicrocomputer is used as the auxiliary microcomputer 32.

As shown in FIG. 5, ECU 30 is equipped with the main microcomputer 31and the auxiliary microcomputer 32. The main microcomputer 31 executesengine control and electronic throttle control. Namely, the mainmicrocomputer 31 calculates the required ignition timing and fuelinjection amount for engine control, and throttle position for throttlecontrol. The main microcomputer 31 outputs a WDC pulse to WDT 33. Thus,the WDT 33 monitors malfunction of the main microcomputer 31 as in thefirst embodiment. Incidentally, a signal based on the calculated resultsby the main microcomputer 31 is transmitted to the motor drive circuit35 through the auxiliary microcomputer 32.

The auxiliary microcomputer 32 monitors the throttle control executed bythe main microcomputer 31. The auxiliary microcomputer 32 has a monitorprogram for executing at every predetermined interval. According to themonitor program, the auxiliary microcomputer 32 detects whether thecalculation of the main microcomputer 31 is accurate, whether themonitor program is started and ended accurately or whether the monitorprogram is executed in the predetermined order.

The auxiliary microcomputer 32 has a timer 34. The timer 34 is set witha predetermined time every time when the monitor program is accomplishednormally. The timer 34 has output compare function. The timer 34 isswitched automatically from high to low, when the time count isdecreased to zero. Thus, throttle motor driving is controlled by a motordrive circuit 35 based on the output logic level of the port.

In this case, when the time counted by the timer 34 is not zero, thethrottle motor is operable. On the other hand, when the time counted bythe timer 34 is zero, the throttle motor is not operable.

Third Embodiment

As shown in FIG. 6, in the third embodiment, the monitor processingadvances to step 205 in response to a negative determination (NO) atstep 202 or 203. Thus, the engine control microcomputer 11 sets zero asthe time count of the timer 15, and the output logic level of thethrottle relay port A is switched to low, immediately. Therefore, whenthe malfunction of the throttle control microcomputer 12 is detected orthe monitor program is not executed normally, the throttle motor 22 isstopped, immediately. Thus, ECU 10 executes throttle control moresafely.

Modifying Embodiment

In the first to third embodiments, a timer for increasing time count canbe utilized in place of the timer 15, 34 for decreasing time count. Whenthe time counted by the timer reaches a predetermined time, an outputlogic level of a port is switched. In this case, when the throttlecontrol function is not detected as malfunctioning and the monitorprogram is executed normally, the timer is reset to zero each time. Tothe contrary, when the throttle control function is detected asmalfunctioning and the monitor program is not executed normally, thetimer is not reset to zero. Thus, when the timer is not reset, the timecounted by the timer reaches the predetermined time (e.g., 80 ms), theoutput logic level of the port is switched.

The microcomputer that monitors the other can be adapted to amicrocomputer utilized for ABS or bag air.

What is claimed is:
 1. An electronic control system comprising: firstand second microcomputer programmed to control a first object and asecond object, respectively; the first microcomputer having a monitorprogram for checking a malfunction of the second microcomputer at apredetermined interval; the first microcomputer including timer meansand timer setting means; the timer means counting time and switching anoutput logic level of a port when a time count reaches a predeterminedvalue; and the timer setting means setting a new time count in place ofthe time counted by the timer means when the second microcomputer isoperating normally and the monitor program is executed normally, whereinthe timer setting means monitors an interval of executing the monitorprogram and sets the new time count when that interval is within apredetermined time range having a beginning time point and an end timepoint.
 2. An electronic control system as in claim 1, wherein: the timerdecrease the time count and switches the output logic level when thetime count reaches zero; and the timer setting means sets a new timecount which is longer than the predetermined interval for executing themonitor program.
 3. An electronic control system as in claim 1, wherein:the monitor program determines whether a calculating result by thesecond microcomputer is normal, and determines whether start timing andend timing monitor program execution is normal or whether executionprocedure of the monitor program is in order; and the timer settingmeans sets the new time count when the first and second determinationare affirmative.
 4. An electronic control system as in claim 1, wherein:the second microcomputer executes an electronic throttle controlprocess; and the first microcomputer stops electronic throttle controlwhen the time count reaches the predetermined value.
 5. An electroniccontrol method for a system having a first microcomputer and a secondmicrocomputer, the first microcomputer including a monitor program and atimer, the electronic control method comprising: monitoring, by thefirst microcomputer, an operation of the second microcomputer based onthe monitor program at successive predetermined intervals; counting, bythe timer of the first microcomputer, time from a predetermined valuewhich is set larger than the predetermined interval; checking, by thefirst microcomputer, whether the time counted by the counting step iswithin a predetermined time range, the predetermined time range having abeginning time point and an end time point, defined by the predeterminedvalue and the predetermined interval; and determining, by the firstmicrocomputer, abnormality of monitor program execution when the timecounted is outside the predetermined range time range having thebeginning time point and an end time point.
 6. An electronic controlmethod as in claim 5, further comprising: changing, by the firstmicrocomputer, the time counted to the predetermined value when the timecounted is within the predetermined time range.
 7. An electronic controlmethod as in claim 6, wherein: an abnormality is determined after thetime counted reaches the predetermined value.
 8. An electronic controlmethod as in claim 6, wherein: an abnormality is determined immediatelywhen the time counted becomes outside the predetermined time range.